CISM Information Security Governance Practice Question
During a policy exception review, the CISO identifies that multiple exceptions have been granted for the same control due to business constraints. What is the best course of action?
⚠ Common exam trap
The trap is choosing a control-oriented response (increase monitoring, reject exceptions) when the scenario describes a systemic policy misalignment — CISM expects you to recognize that repeated exceptions signal a need to fix the policy, not to tighten enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Revise the policy to accommodate the business need
When multiple exceptions are granted for the same control due to recurring business constraints, the control itself is likely misaligned with business reality, so the best action is to revise the policy to accommodate the legitimate business need. This addresses the root cause rather than repeatedly managing exceptions. It also reduces risk by bringing the activity under a formally approved, monitored policy instead of a patchwork of exceptions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Revise the policy to accommodate the business need
Why this is correct
Repeated exceptions for one control signal the policy no longer matches operational reality, so the control itself is misaligned rather than the business being non-compliant. Revising the policy addresses the root cause, eliminating the need for duplicate exceptions and restoring a single, enforceable baseline.
- ✗
Escalate to the board for approval
Why it's wrong here
Board escalation bypasses the risk-based review the CISO should perform, and boards set risk appetite rather than adjudicate individual control exceptions. Escalation suits material, enterprise-wide risks exceeding delegated authority, not a pattern of operational exceptions.
- ✗
Increase monitoring of excepted systems
Why it's wrong here
Monitoring excepted systems detects abuse but leaves the underlying control gap in place, so the recurring business constraint driving repeated exceptions remains unaddressed. Increased monitoring is appropriate when a compensating control already exists and residual risk is accepted at a defined level.
- ✗
Reject all future exceptions for that control
Why it's wrong here
Blanket rejection ignores the legitimate business constraints that caused the exceptions and would halt affected operations without reducing risk. Refusing exceptions is appropriate only where the control is mandatory, such as a regulatory requirement with no compensating alternative.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.